TocaToca Privacy Policy
1. Controller and scope
The controller responsible for the processing of personal data in connection with TocaToca is:
TangoTunes GmbH Wigandgasse 39 1190 Vienna Austria
Company Register No.: FN 281112a Commercial Court of Vienna VAT ID: ATU62795489
Email: support@tocatoca.com
TangoTunes GmbH operates the TocaToca streaming service.
This Privacy Policy applies to the TocaToca streaming service, including its website and web application, Progressive Web App (PWA), mobile applications, authentication and account-management services, streaming functions and related support services. This includes in particular the services provided through tocatoca.com, auth.tocatoca.com and play.tocatoca.com.
2. Personal data we process
2.1 Account and profile data
When you create or use a TocaToca account, we process information required to establish, manage and provide your account.
This may include your name, email address, internal user and account identifiers, language preferences, authentication information, personal settings such as your selected appearance or theme, and the status of your TocaToca access or subscription.
2.2 Playlists and personal settings
When using TocaToca, you may create personal playlists and configure settings for your use of the service.
These data are associated with your account and stored so that they remain available during future sessions and, as described below, if you return to TocaToca at a later date.
2.3 Usage and streaming data
When you use TocaToca, information is generated about how you use the service and the music catalogue.
This may include recordings you play, the date, time and frequency of playback, track starts and track changes, playlists you create or modify, interactions with the music catalogue, duration and frequency of use, and other usage information necessary to provide the streaming service.
This information may be associated with your user account.
2.4 Technical and security data
We also process technical information required to operate and protect TocaToca.
This may include IP address, browser and device information, operating system and user agent, dates, times and duration of access, streaming requests and stream starts, frequency and timing of requests, volume of data transferred, information about simultaneous or unusual access, and technical error and security information.
These data are used in particular to provide a reliable service, diagnose technical problems and identify abusive or automated use.
2.5 Communications with us
If you contact us by email or through a support function, we process the information you provide and the related correspondence to the extent necessary to respond to your request.
3. Payment and subscription information
Payments for TocaToca are processed by external payment service providers, in particular Stripe.
TocaToca does not store complete credit or debit card details and does not receive your complete card number or card security code.
We do, however, receive and store information required to manage your access to TocaToca. This may include payment and subscription status, the type of product or access purchased, subscription or pass duration, payment or customer references, transaction status, and information about whether your TocaToca access is active.
The payment service provider processes the underlying payment information under its own privacy policy.
4. How we use your data
We use personal data in particular to create and manage your TocaToca account, authenticate users, verify access rights, provide the streaming service, store and restore playlists and personal settings, provide and maintain the technical operation and stability of the service, respond to support requests, administer subscriptions and other forms of access, detect and prevent abuse and automated catalogue extraction, improve TocaToca and its user interface, develop and curate our music catalogue, prepare statistical analyses, comply with legal obligations and establish, exercise or defend legal claims.
5. Analysis of listening and usage behaviour
TocaToca processes information about how the streaming service and music catalogue are used.
This enables us, for example, to understand which recordings are played frequently, which recordings are rarely or never played, how users navigate and use the catalogue, which TocaToca functions are actually used and where navigation or the user experience can be improved.
We use these insights for the editorial and technical development of our catalogue and streaming service.
Analysis may initially be based on usage information associated with an individual account. For longer-term statistical analysis, we use aggregated or anonymised information wherever reasonably possible.
We do not sell this information and do not use your listening history for personalised third-party advertising.
6. Protection against abuse and automated access
TocaToca is a personal streaming service. Automated extraction, systematic downloading or other automated collection of substantial parts of the music catalogue is not permitted.
We therefore use technical and partly automated security mechanisms to identify unusual usage patterns.
These mechanisms may analyse, in particular, the number of different recordings played within specified periods, access frequency, timing and intervals between requests and track changes, simultaneous or parallel streaming activity, volume of data transferred, technical access information and other patterns indicating automated or abusive use.
These security measures are used to protect TocaToca, our music catalogue, our rights and the rights of our partners and rights holders.
Where patterns strongly indicate abusive or automated activity, an account may be temporarily restricted or suspended by automated security mechanisms.
Affected users may contact support@tocatoca.com at any time to request a review. We can review an automated restriction and, where appropriate, lift it.
We do not use these security assessments for advertising or commercial advertising profiling.
7. Legal bases for processing
Where the General Data Protection Regulation (GDPR) applies, we rely in particular on the following legal bases:
Performance of a contract – Article 6(1)(b) GDPR: This applies in particular to account creation and administration, authentication, access verification, streaming, playlists, personal settings and management of an existing TocaToca entitlement.
Legitimate interests – Article 6(1)(f) GDPR: Our legitimate interests include maintaining the security and stability of our service, detecting and preventing fraud and abuse, protecting the service against automated catalogue extraction, improving TocaToca, analysing the use of our music catalogue, improving and curating our catalogue, retaining an inactive account for a reasonable period so that a former subscriber can recover playlists and settings if they return, and establishing, exercising or defending legal claims.
Legal obligations – Article 6(1)(c) GDPR: We may be required to retain certain information under tax, accounting or other legal requirements.
Consent – Article 6(1)(a) GDPR: Where processing requires consent, we rely on your consent. Consent may be withdrawn at any time with effect for the future.
8. Advertising and tracking
TocaToca does not contain third-party advertising.
We do not use third-party advertising trackers in the TocaToca player, and we do not disclose your listening history to third parties so that they can create advertising profiles or provide personalised advertising.
We use usage data to provide and improve TocaToca, for statistical and editorial analysis, and for security and abuse-prevention purposes.
9. Cookies, local storage and app technologies
TocaToca uses technically necessary cookies, local storage and similar technologies where required for authentication, session management, settings, streaming and operation of the website, web application, Progressive Web App or mobile application.
This may include technical caching required for operation of the relevant application.
These technologies are used in particular to maintain an authenticated session, store user and language preferences, provide the application technically and protect the security and functionality of the service.
We do not use these technologies for third-party advertising.
10. Recipients and service providers
We do not sell personal data.
We do not disclose personal data to third parties so that they may use it for their own advertising purposes.
We use specialised service providers to operate TocaToca. These include providers of cloud and server infrastructure, network, content-delivery and security services, payment processing, email and communication services, and technical operation and maintenance.
Service providers used in connection with TocaToca include in particular Exoscale for parts of our server and cloud infrastructure, Cloudflare for network, security and delivery functions, and Stripe for payment processing.
These providers receive only the information required to perform their respective services.
Where a service provider processes data on our behalf, processing is subject to appropriate data-protection arrangements.
TocaToca applications may be distributed through third-party application stores, including Google Play and the Apple App Store. These platform providers may process information relating to your store account, device, installation, application updates and distribution of the app under their own privacy policies and in their own responsibility.
Personal data may also be disclosed to public authorities, courts or other bodies where we are legally required to do so or where this is necessary to establish, exercise or defend legal claims.
11. International data transfers
Some of the service providers we use may process personal data outside Austria or outside the European Economic Area.
Where personal data are transferred to countries outside the European Economic Area, we ensure that an appropriate transfer mechanism under applicable data-protection law is available.
This may include an adequacy decision of the European Commission or appropriate contractual safeguards.
12. Data retention
We retain personal data only for as long as necessary for the relevant purpose or while another lawful basis for continued retention applies.
Active accounts: While a TocaToca account is actively used, we retain the information required for the account and use of the service, including playlists and personal settings.
End of subscriber status: When paid access to TocaToca ends, we do not automatically delete the TocaToca account.
We generally retain the account, including associated personal settings, playlists and other user configurations, for up to three years after subscriber status ends.
This allows a user who subscribes to TocaToca again at a later date using the same email address to continue using the existing account, including previous playlists and settings.
After this period, personal account data and personal content will be deleted or anonymised unless legal retention obligations or another lawful reason require further retention.
Usage, streaming and security data: Detailed usage, streaming and security data are retained in personally identifiable form only for as long as necessary to operate and secure TocaToca, detect and investigate abuse, improve the service, or establish, exercise or defend legal claims.
They are then deleted or anonymised.
Aggregated or genuinely anonymised statistics, for example statistics about the overall popularity of particular recordings, may continue to be used for statistical and editorial analysis and for development of the TocaToca catalogue.
Information subject to statutory retention obligations: Information subject to statutory retention requirements, including certain accounting and tax-related information, is retained for the period required by law.
13. Deleting a TocaToca account
You may request complete deletion of your TocaToca account at any time.
A deletion request can be initiated through:
https://tocatoca.com/en/delete-account/
Alternatively, you may contact support@tocatoca.com.
TocaToca also provides an accessible path within the service for initiating account deletion.
To protect users against unauthorised account deletion, we may request reasonable verification of identity before completing a deletion request, for example through the authenticated account or the email address associated with the account.
Following a verified deletion request, we will delete without undue delay, in particular, the TocaToca user account and profile information, personal settings and themes, personal playlists, personalised usage data associated with the account, and other personal information associated with the account, unless a legal obligation or another lawful and necessary reason requires limited further retention.
Ending, not renewing or pausing a subscription is not the same as requesting account deletion. In such cases, the account will generally be retained for up to three years as described in Section 12.
Effect on an active subscription:
Access to TocaToca ends immediately when the account is deleted.
If an automatically renewing subscription managed directly by TocaToca is active when the account is deleted, we cancel that subscription as part of the deletion process so that it will not renew automatically.
Account deletion does not automatically result in a refund of payments already made. Any statutory or otherwise existing refund rights remain unaffected.
Where a subscription is managed through an external app store or another payment provider and cannot be terminated directly by us, additional steps with the relevant provider may be required. Where applicable, we will inform you about this during the deletion process.
If specific information must continue to be retained, for example due to a legal obligation, for investigation of a specific security or abuse incident, or for establishment or defence of legal claims, that information will be retained only for the relevant purpose and will no longer be used for normal operation of the deleted account.
14. Security
We use appropriate technical and organisational measures designed to protect personal data against loss, misuse, unauthorised access, unauthorised disclosure and alteration.
Communication with TocaToca services is generally protected through encrypted connections.
Access to personal data is limited to persons and systems requiring such access for operation, maintenance, support or security of the service.
15. Your data-protection rights
Subject to applicable data-protection law, you may have the right to obtain access to personal data we process about you, have inaccurate data corrected, request deletion of your data, request restriction of processing, receive your data in a portable format where the statutory requirements are met, object to processing based on our legitimate interests, and withdraw consent at any time with effect for the future.
If an automated security measure has resulted in restriction or suspension of your TocaToca account, you may also request a review by us.
Requests may be sent to support@tocatoca.com.
You also have the right to lodge a complaint with a competent data-protection supervisory authority.
For TangoTunes GmbH, the relevant Austrian supervisory authority is:
Austrian Data Protection Authority Barichgasse 40–42 1030 Vienna Austria
16. Changes to this Privacy Policy
We may update this Privacy Policy when TocaToca, our data processing activities, the technologies we use or applicable legal requirements change.
The current version will be published on our website. The date of the latest update will be stated at the beginning of this Privacy Policy.
support@tocatoca.com